Method, device and equipment for dynamically adjusting threshold data of network security rule

Abstract

The embodiment of the invention provides a method, a device and equipment for dynamically adjusting threshold data of a network security rule, which are applied to the technical field of information security. The method comprises the following steps: acquiring historical behavior data of a plurality of users in a service system according to a preset period; the DBSCAN clustering algorithm model determines a neighborhood radius epsilon and a minimum sample number MinPts meeting preset conditions according to parameter combinations of different neighborhood radiuses epsilon and the minimum sample number MinPts based on key features of users in the training set; the method comprises the following steps: determining a user behavior, performing verification, determining a safety rule threshold, monitoring the user behavior based on the safety rule threshold, generating an incremental data set according to the user behavior and alarm processing, and determining an updated safety rule threshold of a target behavior by adopting a DBSCAN clustering algorithm model. By automatically learning and analyzing the change of the historical data, the security rule threshold can be intelligently adjusted without excessively depending on the experience of a service expert, so that the false alarm rate and the missing report rate are reduced, and the network security protection capability is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a method, device, equipment and storage medium for dynamically adjusting network security rule threshold data. Background Art

[0002] In the field of information security, security data analysis products (such as Security Operations Center (SOC), Cybersecurity Situation Awareness, etc.) are a center that integrates people, processes, and technology. It is responsible for detecting all activities of endpoints, servers, databases, network applications, websites, and other systems around the clock to discover potential threats in real time; prevent, analyze, and respond to cybersecurity incidents to improve the organization's cybersecurity posture. The rule settings in security data analysis products are crucial to ensuring the organization's cybersecurity. They determine the specific scenarios and conditions for triggering security alerts, that is, when and under what circumstances an alert should be issued.

[0003] At present, the rule setting in security data analysis products mostly relies on internal or external security experts. Experts manually set the thresholds for security events based on their own experience and understanding of network conditions, combined with data analysis. These thresholds are usually expressed in the form of "n times in m minutes" and are used to determine whether the frequency of security events in a specific time period exceeds the preset limit.

[0004] Existing technologies rely on the experience of business experts to customize rule settings for specific business scenarios and make real-time adjustments based on business needs. However, this requires high personnel requirements, is difficult to update in a timely manner, and has problems such as false positives, missed positives, and untimely responses. Summary of the invention

[0005] The present invention provides a method, device, equipment and storage medium for dynamically adjusting network security rule threshold data.

[0006] According to a first aspect of the present disclosure, a method for dynamically adjusting network security rule threshold data is provided, the method comprising:

[0007] Obtain historical behavior data of multiple users in the business system according to a preset period;

[0008] Extract the key features of each user as training set and validation set;

[0009] The training set is input into the DBSCAN clustering algorithm model. The DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts.

[0010] Based on the key features of the users in the validation set, the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions corresponding to the DBSCAN clustering algorithm model are verified to determine the security rule threshold of the target behavior;

[0011] Monitor user behavior based on security rule thresholds;

[0012] Generate incremental data sets based on user behavior and alarm handling;

[0013] The DBSCAN clustering algorithm model is used to determine the security rule threshold of the updated target behavior.

[0014] In some implementations of the first aspect, the training set is input into the DBSCAN clustering algorithm model, and the DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet preset conditions based on key features of users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts, including:

[0015] Input the training set into the DBSCAN clustering algorithm model;

[0016] The DBSCAN clustering algorithm model is based on the key features of users in the training set. It performs density evaluation according to different neighborhood radius ∈ and MinPts parameter combinations, evaluates the impact of different parameter combinations on the effect of the DBSCAN clustering algorithm model, and determines the neighborhood radius ∈ and MinPts parameters that meet the preset conditions.

[0017] In some implementations of the first aspect, the method further includes:

[0018] According to the clustering of user behaviors, abnormal behaviors are classified into different types;

[0019] By dividing into different types, the corresponding security rule threshold range is generated.

[0020] In some implementations of the first aspect, the key feature of each user is a multidimensional feature vector determined based on event occurrence time, behavior frequency, event type, and user identification information.

[0021] In some implementations of the first aspect, historical behavior data of multiple users in a business system are obtained according to a preset period, and key features of each user are extracted as a training set and a validation set, including:

[0022] Collect log data from business systems, network devices, and security devices according to preset cycles;

[0023] Clean the collected log data to remove duplicate, erroneous, invalid or sensitive information;

[0024] Integrate and standardize the cleaned data;

[0025] From the standardized data, the key features of each user are extracted and divided into training set and validation set.

[0026] In some implementations of the first aspect, the method further includes:

[0027] Evaluate the performance of the DBSCAN clustering algorithm model and calculate the false positive rate and false negative rate indicators for subsequent iterations of the DBSCAN clustering algorithm model.

[0028] In some implementations of the first aspect, determining a security rule threshold of a target behavior includes:

[0029] Based on the verified neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions, cluster calculation is performed on the key features of the user corresponding to the target behavior to determine the corresponding security rule threshold.

[0030] According to a second aspect of the present disclosure, a device for dynamically adjusting network security rule threshold data is provided, the device comprising:

[0031] The acquisition module is used to obtain the historical behavior data of multiple users in the business system;

[0032] The processing module is used to extract the key features of each user as training sets and validation sets;

[0033] The training module is used to input the training set into the DBSCAN clustering algorithm model. The DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts;

[0034] The verification module is used to verify the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions corresponding to the DBSCAN clustering algorithm model based on the key features of the users in the verification set, so as to determine the security rule threshold of the target behavior;

[0035] A monitoring module, used to monitor user behavior based on the security rule threshold;

[0036] The processing module is also used to generate incremental data sets based on user behavior and alarm handling;

[0037] The training module is also used to determine the security rule threshold of the updated target behavior using the DBSCAN clustering algorithm model.

[0038] According to a third aspect of the present disclosure, an electronic device is provided, the electronic device comprising: a memory and a processor, wherein a computer program is stored in the memory, and the above method is implemented when the processor executes the program.

[0039] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method according to the first aspect of the present disclosure is implemented.

[0040] The present disclosure obtains the historical behavior data of multiple users in the business system according to a preset period, extracts the key features of each user as a training set and a validation set; the DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum sample number MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum sample number MinPts; then the DBSCAN clustering algorithm model is verified based on the validation set to determine the security rule threshold of the target behavior, monitor the user behavior based on the security rule threshold, generate an incremental data set based on the user behavior and alarm handling, and then use the DBSCAN clustering algorithm model to determine the updated security rule threshold of the target behavior. The present disclosure can intelligently adjust the security rule threshold by automatically learning and analyzing the changes in historical data, without relying too much on the experience of business experts, thereby reducing the false alarm and missed alarm rates and improving network security protection capabilities.

[0041] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:

[0043] Figure 1 A schematic diagram of a process for dynamically adjusting network security rule threshold data according to an embodiment of the present disclosure is shown;

[0044] Figure 2 A block diagram of a network security rule threshold data dynamic adjustment device according to an embodiment of the present disclosure is shown;

[0045] Figure 3 A block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0047] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0048] In the present disclosure, in order to solve the above technical problems, a method, device, equipment and storage medium for dynamically adjusting network security rule threshold data are provided. The historical behavior data of multiple users in the business system are obtained according to a preset period, and the key features of each user are extracted as a training set and a verification set; the density-based spatial clustering algorithm (DBSCAN) determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts; then the DBSCAN clustering algorithm model is verified based on the verification set, and the security rule threshold of the target behavior is determined, based on the determined security rule threshold of the target behavior, the user behavior is monitored based on the security rule threshold, and an incremental data set is generated according to the user behavior and alarm disposal, and then the DBSCAN clustering algorithm model is used to determine the updated security rule threshold of the target behavior. The present disclosure can intelligently adjust the security rule threshold by automatically learning and analyzing the changes in historical data, without relying too much on the experience of business experts, thereby reducing the false alarm and missed alarm rates and improving the network security protection capability.

[0049] Figure 1 A schematic diagram of a process for dynamically adjusting network security rule threshold data according to an embodiment of the present disclosure is shown. Figure 1 As shown, the network security rule threshold data dynamic adjustment method 100 may include:

[0050] S101, obtaining historical behavior data of multiple users in a business system according to a preset period.

[0051] S102, extracting key features of each user as training sets and verification sets.

[0052] In some embodiments, in order to accurately determine the training set and the validation set, the above-mentioned acquisition of historical behavior data of multiple users in the business system according to a preset period and extraction of key features of each user as the training set and the validation set may specifically include:

[0053] Collect log data from business systems, network devices, and security devices according to preset cycles;

[0054] Clean the collected log data to remove duplicate, erroneous, invalid or sensitive information;

[0055] Integrate and standardize the cleaned data, where the integration step may specifically be to organize the data from different sources into a unified format, and the standardization step may specifically be to convert the corresponding timestamps into a unified time zone;

[0056] From the standardized data, the key features of each user are extracted and divided into training set and validation set.

[0057] The key feature of each user is a multidimensional feature vector determined based on the event occurrence time, behavior frequency, event type and user identification information. Specifically, the multidimensional feature vector X is composed of multidimensional data, X = \{x1, x2, ..., xn\}, where each element is a feature value of the behavior event.

[0058] That is to say, after the data preprocessing is completed, that is, after the standardized data is obtained, the next step is to extract features related to business activity patterns, personnel behavior patterns, and potential attack methods from the massive data, and apply feature selection technology to screen out the key features of each user that have a significant impact on the threshold adjustment. For example, for intelligent threshold calculation, the key features to be extracted may include:

[0059] Event occurrence time, used to analyze the time distribution and density of behaviors.

[0060] Event frequency, also known as behavior frequency, is used to detect sudden and frequent operations by analyzing the number of behaviors of the same user within a specific time period.

[0061] Event types, such as login, wrong password, and other operational behaviors, are used to classify different types of business operations.

[0062] User identification information, including user ID, IP address, etc., is used to associate the operation behaviors of different users.

[0063] After screening, these features serve as input data for the subsequent DBSCAN clustering algorithm model, that is, the intelligent model training.

[0064] In the above embodiment, by cleaning, integrating and standardizing the historical behavior data of multiple users obtained according to a preset period, and then extracting the key features of each user and dividing them into a training set and a verification set, the accuracy and standardization of the training set and the verification set can be improved, thereby improving the accuracy and efficiency of subsequent training and verification of the DBSCAN clustering algorithm model.

[0065] S103, input the training set into the DBSCAN clustering algorithm model, and the DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum sample number MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum sample number MinPts.

[0066] In some embodiments, in S103, the training set is input into the DBSCAN clustering algorithm model. The DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts. Specifically, the process may include:

[0067] Input the training set into the DBSCAN clustering algorithm model;

[0068] The DBSCAN clustering algorithm model is based on the key features of users in the training set. It performs density evaluation according to different neighborhood radius ∈ and minimum sample number MinPts parameter combinations, evaluates the impact of different parameter combinations on the effect of the DBSCAN clustering algorithm model, and determines the neighborhood radius ∈ and MinPts parameters that meet the preset conditions.

[0069] It should be further explained that the goal of the DBSCAN clustering algorithm is to identify clustered areas (high-density points) in the data by defining a density threshold, while marking sparse points as noise. It clusters the target behavior and determines the corresponding threshold by setting two key parameters, namely the neighborhood radius ∈ and the minimum number of samples (Minimum Points, MinPts).

[0070] Where, neighborhood radius ∈: defines the range within which events are considered to be related to each other.

[0071] Minimum number of samples MinPts: The minimum number of event points within the range ∈ to be considered a valid cluster.

[0072] In the above embodiment, the DBSCAN clustering algorithm model is trained by using a training set for automatic determination of subsequent target behavior thresholds, thereby being able to intelligently adjust security rule thresholds without relying too much on the experience of business experts, thereby reducing false positive and false negative rates and improving network security protection capabilities.

[0073] In the scenario of intelligent thresholds, the DBSCAN clustering algorithm model takes user behavior (such as incorrect password entry events) as input data and evaluates the density distribution of events, that is, it analyzes the operation behavior of each user within a specific time window, identifies areas of intensive operations, and generates appropriate m and n values ​​based on the clustering results, thereby automatically identifying frequent abnormal behaviors and generating thresholds.

[0074] It should be further explained that during the clustering analysis of the DBSCAN clustering algorithm model, the output can be an intelligent range of the behavior number threshold f under different time windows e. Specifically, the model outputs the following two key values:

[0075] e: The optimal time window size, which indicates how long the behavior is evaluated.

[0076] f: Behavior count threshold, which indicates the maximum number of times a behavior is allowed to occur within the time window e. If it exceeds the threshold, it is considered abnormal.

[0077] The model analyzes the operation behavior of each user within a specific time window, identifies the area of ​​intensive operation, and generates appropriate e and f values ​​based on the clustering results. For example, the DBSCAN clustering algorithm model can output: within 3 minutes, when the number of incorrect password inputs by the user exceeds 5 times, an abnormal alarm is triggered.

[0078] Specifically, in order to ensure the accuracy and robustness of the DBSCAN clustering algorithm model, the present disclosure adopts a set of automatic tuning mechanisms to optimize and adjust the key parameters ∈ and MinPts in the model. The specific training and optimization steps can be as follows:

[0079] 1. Parameter initialization: Initially, the model sets the ∈ and MinPts parameters, which are defined as the common operation behavior density in the business system (such as the frequency of operation behaviors within a specific range within the same time period). At this time, the initial value can be set based on empirical data, ∈ can be set to a time range of a period of time (such as 1 minute), and MinPts can be set to the minimum number of operations within a certain time period (such as 3 times).

[0080] 2. Model training: The training process is based on iterative learning of historical data sets. The system performs density assessment based on the input data and finds the most suitable density threshold based on different combinations of ∈ and MinPts parameters to ensure that the model can identify sudden abnormal behaviors in the business system.

[0081] 3. Automatic parameter adjustment: In each training cycle, the impact of different parameters on the model effect can be evaluated through cross-validation, and the ∈ and MinPts parameters can be automatically adjusted to find the optimal density distribution, so that the model can generate a reasonable intelligent threshold range in most scenarios.

[0082] In addition, during the model training process, abnormal behaviors can be divided into different types based on the clustering of user behaviors; and corresponding threshold ranges can be generated through the different types of division.

[0083] Specifically, during the model training process, abnormal behaviors can be automatically classified into different types based on the clustering of user behaviors, such as frequent password input errors in a short period of time, repeated login attempts on the same device, etc. Through classification, targeted threshold ranges can be generated to improve the accuracy of anomaly detection.

[0084] In addition, in a specific example, the process of setting the parameter range may specifically include:

[0085] Parameter range setting: First determine the range of the neighborhood radius (∈) and the minimum number of samples (MinPts). This usually requires a preliminary estimate based on the characteristics of the data and domain knowledge. For example, if the distance metric between data points is between (0-10), ∈ can start with a smaller value (such as 0.5) and gradually increase to a larger value (such as 3); for MinPts, you can start with 3 and increase by 1 or 2 each time until you reach a reasonable upper limit (such as 10% of the total number of data points).

[0086] Iteratively try different parameter combinations: For each combination of ∈ and MinPts, the DBSCAN algorithm can be run on 80% of the training set data. For example, the first try ∈ = 0.5 and MinPts = 3, the DBSCAN algorithm will divide the data points into different clusters (including possible noise points) according to these parameters.

[0087] Record the results of each clustering: including the number of clusters, the number of data points in each cluster, and one or more of the center positions of the clusters. This information will help us evaluate whether the clustering pattern is reasonable later.

[0088] Observe the clustering pattern: Observe the changes in the clustering pattern while trying different parameter combinations. For example, when ∈ is small, more small clusters may be obtained because data points need to meet the minimum number of samples in a small neighborhood to form a cluster; as ∈ increases, the number of clusters may decrease, and some small clusters may merge into large clusters.

[0089] Based on business knowledge and expectations of the data, some clustering patterns that seem reasonable are initially screened out. For example, if it is known that there should be several different types of normal behavior and possible abnormal behavior in the data, when the clustering results can roughly distinguish these different types, the clustering pattern under this parameter combination may be more promising.

[0090] S104, based on the key features of the users in the verification set, verify the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions corresponding to the DBSCAN clustering algorithm model, and determine the security rule threshold of the target behavior.

[0091] In S104, the verification process can be specifically based on the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions corresponding to the DBSCAN clustering algorithm model, and perform clustering quality evaluation on the key features of the users in the verification set. When the clustering quality meets the requirements, that is, it is higher than the preset clustering quality evaluation threshold, the corresponding security rule threshold is further determined. Otherwise, the training set is used to continue training, or the training can be stopped when the maximum number of iterations is reached on the verification set.

[0092] It should be noted that after obtaining the verified neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions, the process of determining the target behavior threshold can specifically be to perform clustering evaluation on the key features of the user corresponding to the target behavior based on the verified neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions, so as to further determine the corresponding security rule threshold.

[0093] In addition, in some embodiments, the performance of the DBSCAN clustering algorithm model can also be evaluated, and the false alarm rate and missed alarm rate indicators can be calculated for subsequent DBSCAN clustering algorithm model iterations to further improve the accuracy of the subsequent DBSCAN clustering algorithm model in determining the target behavior threshold.

[0094] In a specific example, clustering quality assessment (Silhouette Coefficient) on the validation set may include,

[0095] Calculate the silhouette coefficient for each data point: For the selected parameter combination, it can be applied to 20% of the validation set data. For each data point i in the validation set, calculate its average intra-cluster distance a(i) and minimum average inter-cluster distance b(i), and then calculate the silhouette coefficient

[0096] Calculate the average silhouette coefficient: Calculate the average of the silhouette coefficients of all data points in the validation set Where n is the total number of data points in the validation set.

[0097] Evaluate clustering quality: Evaluate clustering quality based on the value of the average silhouette coefficient S. If If it is close to 1, it means that the clustering effect is very good, the data points are close in the cluster to which they belong, and the separation between different clusters is high; if If it is close to -1, the clustering effect is poor; if If it is close to 0, it means that the clustering results may have overlapping clusters or it is difficult to clearly distinguish different clusters.

[0098] In addition, when the output average silhouette coefficient value is lower than the preset clustering quality assessment threshold, the parameters need to be readjusted for clustering.

[0099] Specifically, for example, if the average silhouette coefficient is lower than a preset threshold (eg, 0.3), it is considered that the clustering quality does not meet the requirements and the parameters need to be readjusted. This threshold can be determined according to the specific application scenario and the expectation of clustering quality.

[0100] In addition, if the clustering results are too scattered (the average silhouette coefficient is low and the number of clusters is too large), you can increase ∈ or MinPts appropriately to make it easier for data points to merge into larger clusters. Conversely, if the clustering results are too concentrated (the average silhouette coefficient is low and the number of clusters is too small), you can reduce ∈ or MinPts to increase the number of clusters and make the clustering more detailed.

[0101] Then return to the training set and use the new parameter combination to perform clustering again and evaluate on the validation set. Repeat this process until a parameter combination with an average silhouette coefficient that meets the requirements is found, resulting in a relatively ideal clustering quality.

[0102] In addition, in the above process, the clustering results of the validation set can also be analyzed.

[0103] The analysis of clustering results can specifically include inter-cluster distance analysis:

[0104] First, calculate the distance measure between different clusters. For example, if the data is in a multidimensional space, you can use methods such as Euclidean distance and Manhattan distance to measure the distance between cluster centers. Suppose we have two clusters C1 and C2, whose centers are μ1 and μ2 respectively. If we use Euclidean distance, the distance between clusters d(C1,C2) = ||μ1-μ2||2.

[0105] Then observe the distribution of these distances and find a suitable distance threshold. For example, if the distance between the normal behavior cluster and the abnormal behavior cluster (which can be roughly distinguished by partial labeled data or prior knowledge) is significantly larger than the distance between the normal behavior clusters, then this larger distance value can be used as part of the security rule threshold. For example, the average distance between normal behavior clusters is d normal , the minimum distance between abnormal behavior cluster and normal behavior cluster is d abnormal-normal , you can set the security rule threshold to dthreshold = k × d normal (k is a coefficient greater than 1, determined by adjusting the validation set), when the distance between the new data point and the nearest normal behavior cluster center is greater than d threshold , it may be judged as abnormal.

[0106] The analysis of clustering results can also include cluster density analysis:

[0107] Calculate the density of each cluster. A simple method is to count the number of data points per unit space. For cluster C, assume its volume is V(C) (the volume can be estimated by a geometric shape such as the smallest hypercube that contains all the data points in the cluster), and the number of data points is n(C), then the cluster density is

[0108]

[0109] Then compare the density difference between normal behavior clusters and abnormal behavior clusters. Usually, due to its particularity, abnormal behavior may be relatively sparsely distributed in the data space. If the density of a cluster is found to be significantly lower than that of the normal behavior cluster, and the cluster is suspected to be related to abnormal behavior, the density value can be used as a reference for the security rule threshold. For example, set a density threshold ρ threshold , if the density of the cluster to which the new data point belongs (if the cluster is not yet determined, it can be preliminarily judged based on its distance from the cluster center, etc.) is lower than ρ threshold , it can be considered as an exception.

[0110] Then, the comprehensive threshold can be determined in combination with the silhouette coefficient. Specifically, the silhouette coefficient can be used to evaluate the clustering quality. Clusters with lower silhouette coefficients may contain more abnormal behaviors. For these clusters, the security rule threshold can be set more strictly.

[0111] Taking all these factors into consideration, a comprehensive safety rule threshold is determined by multiple trials and adjustments in the validation set. For example, a weighted formula can be established to determine the threshold, assuming T = w1×d threshold +w2×ρ threshold +w3×S threshold (W1, w2, and w3 are weight coefficients, which are determined based on the experimental results of the validation set. threshold is a threshold based on the inter-cluster distance, ρ threshold is a threshold based on cluster density, S threshold is a threshold value based on the silhouette coefficient indicator). When the calculation result of the relevant indicator of the new behavior data exceeds the threshold T, it is determined to be an abnormal behavior.

[0112] After the threshold is initially determined, its effectiveness can be further verified on the validation set. The data in the validation set is used to judge abnormal behavior according to the newly determined security rule threshold, and the false alarm rate (the proportion of normal behavior mistakenly judged as abnormal behavior) and the false negative rate (the proportion of abnormal behavior mistakenly judged as normal behavior) are calculated.

[0113] Optimize and adjust the threshold according to the false alarm rate and missed alarm rate. If the false alarm rate is too high, the threshold can be appropriately relaxed; if the missed alarm rate is too high, the threshold needs to be tightened. This process may need to be repeated many times until a satisfactory result is achieved that balances the false alarm rate and missed alarm rate.

[0114] S105: Monitor user behavior based on security rule thresholds.

[0115] S106: Generate an incremental data set based on user behavior and alarm handling.

[0116] S107, using the DBSCAN clustering algorithm model to determine the updated security rule threshold of the target behavior.

[0117] Among them, incremental training is to continue training the model with new data based on the trained model, so that the model can continuously learn and adapt to new information, without having to start training from scratch. In addition, the process of incrementally training the DBSCAN clustering algorithm model using updated historical behavior data of users can be trained only with newly generated behavior data, or with newly generated behavior data and historical data superimposed for training.

[0118] It can be seen that the present disclosure introduces a threshold dynamic adjustment mechanism based on the output of the DBSCAN clustering algorithm model. After identifying the behavior density under different time windows, the DBSCAN clustering algorithm model automatically generates the corresponding threshold range, and can perform periodic incremental training according to the changes in real-time data, and then adjust to a security rule threshold that is more in line with the user scenario.

[0119] During the threshold adjustment process, the model needs to be retrained regularly, and the ∈ and MinPts parameters need to be adjusted based on the latest user behavior data to ensure that the threshold can accurately reflect the changes in behavior patterns in the current business environment.

[0120] Specifically, in order to improve the accuracy and real-time performance of the DBSCAN clustering algorithm model, the present disclosure designs a monitoring and feedback mechanism to ensure that the output of the model can timely reflect the actual situation of the business system. The details are as follows:

[0121] Real-time monitoring: Monitor business operations in real time, automatically record user behavior, and evaluate whether the behavior meets the current threshold range.

[0122] Feedback mechanism: Alarms are handled. Alarms marked as "handled" are considered true abnormal events and black samples, and the relevant original logs are removed during retraining; alarms marked as "ignored" are considered non-abnormal events, and the relevant original logs are retained for incremental training.

[0123] Through monitoring and feedback, the threshold can be adaptively adjusted to effectively reduce false positives and missed negatives and improve the accuracy of anomaly detection.

[0124] Furthermore, in order to maintain the long-term effectiveness of the model, the present disclosure can also introduce an iterative optimization mechanism of the intelligent learning model. In each update cycle, the system continuously iterates and trains the DBSCAN clustering algorithm model based on the feedback data of real-time monitoring, and adjusts key parameters such as ∈ and MinPts to optimize the threshold calculation.

[0125] Dataset update: Alarms marked as "processed" are considered true abnormal events and black samples, and the relevant original logs are removed during retraining; alarms marked as "ignored" are considered non-abnormal events, and the relevant original logs are retained and divided into updated training sets and validation sets for incremental training to ensure that the model can be continuously optimized so that the latest behavior patterns can be recognized.

[0126] Model parameter tuning: Through the automatic parameter tuning algorithm, the parameters of the DBSCAN model are regularly optimized so that it can be dynamically adjusted according to the behavior density at different times in the business system and continuously optimize the threshold calculation.

[0127] Effect evaluation: After each cycle, the system will automatically evaluate the performance of the model, calculate indicators such as false alarm rate and missed alarm rate, and use this as a basis to optimize the next model iteration process.

[0128] Through continuous iterative optimization, the solution disclosed in the present invention can ensure that the threshold always reflects the actual needs in the current business environment, effectively improving the security and anomaly detection capabilities of the business system.

[0129] In the process of S101-S107, by automatically learning and analyzing the changes in historical data in a periodic manner, the security rule thresholds can be adjusted intelligently and dynamically without relying too much on the experience of business experts, thereby reducing false alarm and missed alarm rates and improving network security protection capabilities.

[0130] The present disclosure constructs a prediction model based on machine learning, learns reasonable parameters under different rules based on historical data, and thus sets rule thresholds that are more in line with the real environment. The selected machine learning model is trained using historical data divided into a training set and a validation set, and the model parameters are iteratively updated by calculating the loss function and applying the optimization algorithm until the predetermined performance is achieved on the validation set or the maximum number of iterations is reached.

[0131] In addition, we set a reasonable threshold setting mode based on the actual needs and security policies of the organization, and based on the prediction results of the intelligent learning model, we comprehensively consider false alarms and missed alarms, and continuously adjust the security rule thresholds in security data analysis products to ensure the rationality of the thresholds.

[0132] Furthermore, the alarms generated by security data analysis products and new business data received are monitored in real time, and the alarms are processed and fed back. According to the user's processing or ignoring of the alarms, the corresponding rule thresholds are adjusted. The performance of the intelligent learning model is evaluated regularly, including indicators such as accuracy, recall rate, and F1 score. According to the model evaluation results, alarm feedback, and new business data, the intelligent learning model is iteratively optimized regularly or based on the growth of data volume to improve the accuracy of threshold adjustment.

[0133] The disclosure can intelligently adjust the threshold of security rules by automatically learning and analyzing historical data, without relying too much on the experience of business experts. This not only reduces the high requirements for expert quality, but also reduces the risks caused by expert shortage or mobility, while reducing personnel costs.

[0134] Since the present disclosure can analyze changes in network environment and business activity patterns in real time and dynamically adjust thresholds based on these changes, it can more accurately identify potential security threats and trigger security alerts in a timely manner. This helps security teams respond to and handle security incidents more quickly and reduce security risks.

[0135] Traditional fixed threshold setting methods often cannot adapt to the ever-changing network environment and attack methods, resulting in high false positive and false negative rates. However, the present disclosure can more accurately predict and identify security events through intelligent learning and dynamic adjustment mechanisms, thereby reducing false positive and false negative rates and improving the accuracy of security alerts.

[0136] The present disclosure can continuously learn and optimize the intelligent learning model through real-time monitoring and feedback mechanism, and improve the accuracy of threshold adjustment. This enables the system to better adapt to changes in network environment and business activities, and improve the system's adaptability and flexibility.

[0137] The above is an introduction to the method embodiment. The following is a further explanation of the disclosed solution through an apparatus embodiment.

[0138] Figure 2 A block diagram of a device for dynamically adjusting network security rule threshold data according to an embodiment of the present disclosure is shown.

[0139] like Figure 2 As shown, the network security rule threshold data dynamic adjustment device 200 may include:

[0140] Acquisition module 201, used to acquire historical behavior data of multiple users in the business system;

[0141] The processing module 202 is used to extract the key features of each user as a training set and a validation set; the training module 203 is used to input the training set into the DBSCAN clustering algorithm model, and the DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts;

[0142] Verification module 204, used to verify the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions corresponding to the DBSCAN clustering algorithm model based on the key features of the users in the verification set, so as to determine the security rule threshold of the target behavior;

[0143] A monitoring module 205, configured to monitor user behavior based on the security rule threshold;

[0144] The processing module 202 is also used to generate an incremental data set based on user behavior and alarm handling;

[0145] The training module 203 is also used to determine the updated safety rule threshold of the target behavior using the DBSCAN clustering algorithm model.

[0146] In some embodiments, the training set is input into the DBSCAN clustering algorithm model, and the DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts, including:

[0147] Input the training set into the DBSCAN clustering algorithm model;

[0148] The DBSCAN clustering algorithm model is based on the key features of users in the training set. It performs density evaluation according to different neighborhood radius ∈ and MinPts parameter combinations, evaluates the impact of different parameter combinations on the effect of the DBSCAN clustering algorithm model, and determines the neighborhood radius ∈ and MinPts parameters that meet the preset conditions.

[0149] In some embodiments, the training module 203 is further used to classify abnormal behaviors into different types according to the clustering of user behaviors; and generate corresponding security rule threshold ranges through the different types of classification.

[0150] In some embodiments, the key feature of each user is a multi-dimensional feature vector determined based on event occurrence time, behavior frequency, event type, and user identification information.

[0151] In some embodiments, historical behavior data of multiple users in a business system are obtained according to a preset period, and key features of each user are extracted as a training set and a verification set, including:

[0152] Collect log data from business systems, network devices, and security devices according to preset cycles;

[0153] Clean the collected log data to remove duplicate, erroneous, invalid or sensitive information;

[0154] Integrate and standardize the cleaned data;

[0155] From the standardized data, the key features of each user are extracted and divided into training set and validation set.

[0156] In some embodiments, the training module 203 is also used to evaluate the performance of the clustering algorithm model and calculate the false alarm rate and false negative rate indicators for subsequent DBSCAN clustering algorithm model iterations.

[0157] In some embodiments, determining a network security rule threshold for a target behavior includes:

[0158] Based on the verified neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions, the key features of the user corresponding to the target behavior are clustered for quality assessment to further determine the corresponding security rule threshold.

[0159] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0160] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0161] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0162] Figure 3A block diagram of an exemplary electronic device capable of implementing an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0163] The device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the device 300 can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0164] A number of components in the device 300 are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0165] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as method 100. For example, in some embodiments, the method 100 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the method 100 described above may be performed.

[0166] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0167] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0168] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0169] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0170] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0171] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0172] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of this disclosure can be achieved, and this document is not limited here.

[0173] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for dynamically adjusting network security rule threshold data, characterized in that: The method comprises: Obtain historical behavior data of multiple users in the business system according to a preset period; Extract the key features of each user as training set and validation set; The training set is input into the DBSCAN clustering algorithm model, and the DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts; Based on the key features of the users in the verification set, the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions corresponding to the DBSCAN clustering algorithm model are verified to determine the security rule threshold of the target behavior; Monitoring user behavior based on the security rule threshold; Generate incremental data sets based on user behavior and alarm handling; The DBSCAN clustering algorithm model is used to determine the security rule threshold of the updated target behavior.

2. The method according to claim 1, characterized in that The training set is input into the DBSCAN clustering algorithm model. The DBSCAN clustering algorithm model determines the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions based on the key features of the users in the training set according to different parameter combinations of the neighborhood radius ∈ and the minimum number of samples MinPts, including: Inputting the training set into the DBSCAN clustering algorithm model; The DBSCAN clustering algorithm model is based on the key features of users in the training set. It performs density evaluation according to different neighborhood radius ∈ and MinPts parameter combinations, evaluates the impact of different parameter combinations on the effect of the DBSCAN clustering algorithm model, and determines the neighborhood radius ∈ and MinPts parameters that meet the preset conditions.

3. The method according to claim 2, characterized in that The method further comprises: According to the clustering of user behaviors, abnormal behaviors are classified into different types; By dividing into different types, the corresponding security rule threshold range is generated.

4. The method according to claim 1, characterized in that: The key feature of each user is a multi-dimensional feature vector determined based on event occurrence time, behavior frequency, event type and user identification information.

5. The method according to claim 1, characterized in that The method of obtaining historical behavior data of multiple users in the business system according to a preset period and extracting key features of each user as a training set and a verification set includes: Collect log data from business systems, network devices, and security devices according to preset cycles; Clean the collected log data to remove duplicate, erroneous, invalid or sensitive information; Integrate and standardize the cleaned data; From the standardized data, the key features of each user are extracted and divided into training set and validation set.

6. The method according to claim 1, characterized in that The method further comprises: Evaluate the performance of the DBSCAN clustering algorithm model and calculate the false positive rate and false negative rate indicators for subsequent iterations of the DBSCAN clustering algorithm model.

7. The method according to claim 1, characterized in that The security rule threshold for determining the target behavior includes: Based on the verified neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions, cluster calculation is performed on the key features of the user corresponding to the target behavior to determine the corresponding security rule threshold.

8. A network security rule threshold data dynamic adjustment device, characterized in that: The device comprises: The acquisition module is used to obtain the historical behavior data of multiple users in the business system; The processing module is used to extract the key features of each user as training sets and validation sets; A training module, used for inputting the training set into a DBSCAN clustering algorithm model, wherein the DBSCAN clustering algorithm model determines a neighborhood radius ∈ and a minimum number of samples MinPts that meet preset conditions based on key features of users in the training set according to different parameter combinations of neighborhood radius ∈ and minimum number of samples MinPts; A verification module, used to verify the neighborhood radius ∈ and the minimum number of samples MinPts that meet the preset conditions corresponding to the DBSCAN clustering algorithm model based on the key features of the users in the verification set, so as to determine the security rule threshold of the target behavior; A monitoring module, used to monitor user behavior based on the security rule threshold; The processing module is also used to generate incremental data sets based on user behavior and alarm handling; The training module is also used to determine the security rule threshold of the updated target behavior using the DBSCAN clustering algorithm model.

9. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; It is characterized in that the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-7.

Images